CVE-2022-50066

A vulnerability was found in the Linux kernel's Aquantia Atlantic driver, where a lack of proper bounds checking during loop indexing can lead to an out-of-bounds access. This can lead to undefined system behavior and a denial of service.

This vulnerability in the Aquantia network driver (atlantic) allows out-of-bounds access to the aq_vec[] array, which can lead to a kernel crash. However, triggering this issue requires privileges, as it occurs in internal kernel functions like aq_nic_stop() and aq_vec_isr(), typically invoked during device suspend or shutdown. This bug was observable through a UBSAN report in aq_nic_stop().

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module atlantic from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.